CVE-2024-45641: IBM Security QRadar EDR Auth Bypass Flaw

CVE-2024-45641 Overview

CVE-2024-45641 affects IBM Security ReaQta EDR 3.12 (now branded as IBM Security QRadar EDR). The product fails to properly validate SSL/TLS certificates, enabling an attacker positioned on the network to intercept or tamper with communications. This weakness is tracked under CWE-295: Improper Certificate Validation. Because the endpoint detection and response (EDR) agent communicates with cloud management infrastructure, broken certificate validation undermines the integrity and confidentiality of that channel. IBM published a security bulletin acknowledging the issue and providing remediation guidance.

Critical Impact
An attacker able to intercept network traffic between the EDR agent and its management plane can perform unauthorized actions and view or modify data in transit.

Affected Products

IBM Security QRadar EDR (formerly ReaQta EDR) version 3.12
Deployments running on Linux hosts
Environments where the EDR agent connects to cloud management services over the network

Discovery Timeline

2025-05-20 - CVE-2024-45641 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-45641

Vulnerability Analysis

The vulnerability stems from improper SSL/TLS certificate validation in IBM Security ReaQta EDR 3.12. When the EDR agent establishes a secure connection, it does not fully verify the authenticity of the server certificate presented by the remote endpoint. This gap allows a network-positioned attacker to present a forged or substituted certificate and still complete the TLS handshake. The outcome is a classic transport-layer trust failure: the agent believes it is talking to a legitimate server when it is not. IBM has published a support bulletin describing the issue and the fixed releases.

Root Cause

The root cause is weak certificate chain or hostname verification during TLS session establishment. Implementations that skip certificate pinning, ignore trust anchor validation, or accept certificates signed by untrusted certificate authorities (CAs) create this exposure. CWE-295 covers these conditions and consistently maps to man-in-the-middle (MITM) risk.

Attack Vector

Exploitation requires a network foothold between the EDR agent and the management service. An attacker on the same network path, through compromised infrastructure, DNS redirection, or rogue Wi-Fi, can proxy TLS traffic using an attacker-controlled certificate. Once the handshake succeeds, the attacker can read, modify, or inject messages. The attack requires no authentication and no user interaction, consistent with a network-adjacent interception scenario.

No verified exploit code is publicly available for this vulnerability. Refer to the IBM Support Page for authoritative technical details.

Detection Methods for CVE-2024-45641

Indicators of Compromise

Unexpected TLS certificate issuers presented to EDR agents on outbound connections to IBM QRadar EDR management endpoints.
Repeated TLS session resets or renegotiations between agent hosts and QRadar EDR cloud services.
Presence of unknown proxy intermediaries or new trusted root CAs on hosts running the EDR agent.

Detection Strategies

Capture and inspect TLS metadata on egress to EDR management domains, flagging certificate subject or issuer changes.
Correlate agent connectivity errors with network path anomalies such as DNS resolution changes or new ARP entries.
Audit the EDR agent version inventory against IBM's fixed release to identify hosts still exposed.

Monitoring Recommendations

Monitor outbound connections from EDR-managed endpoints for deviation from known-good certificate fingerprints.
Alert on installation of new trusted root certificates on managed Linux hosts.
Review firewall and proxy logs for unauthorized TLS inspection appliances in the path to IBM QRadar EDR cloud services.

How to Mitigate CVE-2024-45641

Immediate Actions Required

Upgrade IBM Security QRadar EDR agents from version 3.12 to the fixed release documented in the IBM security bulletin.
Inventory all hosts running the affected agent version and prioritize internet-facing and remote-worker systems.
Validate the trust store on each endpoint and remove any unauthorized or unexpected root certificates.

Patch Information

IBM has published remediation details in the official advisory. Apply the vendor-supplied fix referenced in the IBM Support Page. Confirm that upgraded agents enforce full certificate chain and hostname validation after deployment.

Workarounds

Restrict EDR agent egress to known IBM QRadar EDR cloud endpoints using firewall allowlists.
Terminate agent traffic only through trusted network segments and avoid untrusted Wi-Fi or shared transit networks until patched.
Enforce certificate pinning or TLS inspection policies at the network boundary where supported.

bash

# Example: verify the certificate presented by the QRadar EDR management endpoint
openssl s_client -connect <qradar-edr-endpoint>:443 -servername <qradar-edr-endpoint> </dev/null \
  | openssl x509 -noout -issuer -subject -fingerprint -sha256